RCMS vs ISO 14001: Understanding the Responsible Care Management System for Chemical Companies

Chemical companies may think that by implementing ISO 14001 they meet the requirements for Responsible Care ®. ISO 14001 is an internationally accepted standard that provides the framework for an environmental management system. However, the Responsible Care ® program demands more. It adds a layer of requirements for Health & Safety and Security to be integrated along with environmental requirements.

Members of the American Chemistry Council (ACC) commit to implementing a system aligned to either the Responsible Care ® Management System (RCMS) Technical Specification or the RC 14001 which integrates the requirements of RCMS and ISO 14001 into one standard. Companies choosing the RC14001 standard can then claim conformity to both standards while putting in similar effort.

This article clarifies what each framework covers, where they overlap, and how to audit both efficiently

What RCMS Is and Who Requires It

Responsible Care ® is the American Chemistry Council’s (ACC) industry-wide performance initiative. It is not just an environmental standard. The need for a performance standard was identified following major incidents at chemical plants in the 1980s. RCMS is more than just a set of operational requirements. It outlines the requirements for a management system. Management systems include interaction from the highest level of the organization to the lowest level and enables effective interaction across processes.

ACC member companies are contractually required to certify to RC 14001 or RCMS; non-members may still be pulled in by customer or supply-chain requirements. Some organizations may voluntarily opt to confirm to the requirements of these standards. While RCMS is not a regulatory requirement, it is an obligation an ACC member opts to conform to.

RCMS follows the plan-do-check-act cycle and dovetails well with the requirements of ISO 14001. It expands upon the environmental requirements of ISO 14001 to include health & safety and security (HSS). It is also supported by the underlying ACC codes. Namely the Process Safety code, the Product Safety code and the Security code.

RCMS vs ISO 14001: Key Overlaps and Differences

Both standards, the RCMS and RC14001 are management system standards and thus based on the Plan-Do-Check-Act cycle. This means that both require the foundational aspects of a management system. These include leadership commitment, a documented policy, operational controls to manage identified risks, monitoring of the system, internal audits and management reviews.

Each of these standards also require the organization to determine their compliance obligations and to then take measures to meet them and evaluate them. The system as a whole is to be used to drive continual improvement. The key difference is that ISO 14001 has a focus solely on environmental requirements and does not address HSS requirements.

RCMS and RC14001 also integrate loosely via the Process Safety Code the OSHA PSM requirements. It is, however, not a replacement for these regulatory requirements. Further the two RC standards also address product stewardship which entails enhancing EHSS requirements throughout the supply chain from cradle to cradle.

Compared to ISO 14001, the RC standards also carry specific ACC-mandated elements (e.g., community outreach/CAER, security vulnerability assessments) with no ISO 14001 equivalent. There are also different certification requirements when it comes to RCMS and ISO 14001. The RCMS requiring just one audit by an approved provider every three years.

Why Chemical Companies Often Need Both

Depending on the customer base, especially when international, an organization can benefit from using the RC14001 standards. There is an increasing demand from stakeholders for sustainable production and procurement. As such many are seeking ISO 14001 certification. As a member of ACC companies that need to conform to RCMS may benefit from alignment with RC14001. Many downstream customers specify ISO 14001 certification contractually, independent of ACC membership

ACC membership requires member companies must certify to RC 14001 or RCMS on a fixed cycle to remain in good standing. There is however the added benefit to company reputation from an independent verification of practices to demonstrate to stakeholders and interested parties the organization’s commitment to EHSS goals.

Most chemical manufacturers end up needing both frameworks running concurrently rather than choosing one

Combining RCMS and ISO 14001 Audits

These standards aside, if your company has an integrated management system, there is no reason for you not to be doing integrated audits. So, what is an integrated audit? It is an audit where an auditor of team of auditors competent in the requirements of the various standards samples and assess the effectiveness of controls as determined and applied across the organizational processes. This to the various standards the company is certified to.

With ISO moving to the harmonized standard approach starting in 2013, most ISO management system standards including the RC14001 share the same 10 clause approach. This makes it easy to audit the system as there is shared audit evidence across standards. There is also cost savings to the company both from audit time of the auditor and the time of the auditee spent in the audit. There is less burden on the auditees overall from reduced audit fatigue.

An integrated audit essentially has a single audit schedule, combined checklists mapped to both standards’ (RCMS and ISO14001) clauses and one audit team covering both scopes. Companies choosing RC14001 have already integrated the requirements of RCMS and ISO 14001 into one standard and so perform a single audit. Integrated audits also result in fewer duplicate corrective actions for the same root cause

Building Auditor Competence for RCMS and RC14001

The above integrated audits require auditors preferably trained in both standards simultaneously, not two separately trained pools. This of course again to save on time and cost. QMII’s RC14001 Lead Auditor training approved by Exemplar Global covers the requirements of RCMS, RC14001 and the applicable ACC codes.

Auditors must understand the relevant additional RCMS elements in ISO 14001 and be able to be objectives if just performing and ISO 14001 audit versus an RCMS or RC14001 audit. An effective auditing course approaches audits as a positive activity that helps the organization identify improvement opportunities and audits as key in the preventive cycle. With this integrated competence auditors must remain objective and learn to look beyond documented processed to enable better inputs for leadership.

An auditing course apart from the requirements of the standard must also build competence in the principles of ISO 19011 and include hands on workshop that allow auditors to hit the ground running and to quickly contribute to their organization’s audit program.

Conclusion

In conclusion, RCMS and ISO 14001 aren’t competing standards, they’re complementary. RCMS adding in the HSS requirements to build on the foundation of an ISO 14001 if already in place. Those companies choosing between RCMS and RC14001 may want to opt from RC14001 given the later ease of integrating other ISO standards such as ISO 9001.  

A well-trained auditor adds value to the system. They must provide good insight to the leadership on the state of the system, and this can only come from choosing a good sample, including whom to interview, questions to ask and documents to evidence.

ACC membership requires conformity to either RCMS or RC14001. Regardless of the option chosen by an organization, a trained audit team can only add value to the system. To learn more on the differences and build your auditing skills consider QMII’s RC14001 and RCMS Lead Auditor course. 

IATF 16949 vs ISO 9001: What the Automotive Suppliers Need to Know Before Auditing

For suppliers operating in the automotive supply chain, quality management is not just an internal operational goal, it is a mandatory condition of doing business. While ISO 9001 serves as the world’s foundational standard for quality management systems (QMS) across industries, automotive original equipment manufacturers (OEMs) demand a far higher level of rigor. This is generally true of all sectors specific standards. Be it aviation or automotive or nuclear or any other ISO 9001 is not prescriptive or descriptive. It needs interpretation. As the interpretations for a sector of the industry become too many or prescriptive a sector specific standard is born. This is where IATF 16949 enters the frame as an automotive specific standard. Over 40 plus years QMII has built expertise in auditing, consulting and training of this standard.

Navigating the transition or managing a dual-standard audit requires a clear understanding of where ISO 9001 ends and IATF 16949 begins. Before entering an audit, suppliers must understand the structural hierarchy, specific core tools, standard clauses, and auditor requirements necessary to achieve and maintain certification. IATF 16949 Builds on ISO 9001. The system approach remains the underlying driver. A common misconception among suppliers is that IATF 16949 is a standalone quality standard that replaces ISO 9001. IATF 16949 is a sector-specific supplement layered on top of ISO 9001:2015, not a replacement. ISO 9001 provides the core quality management system baseline and IATF 16949 provides the automotive specific sector requirements.

Harmonized Structure (HS) Integration

IATF 16949 uses the exact same HS, as the ISO 9001:2015, comprising 10 core clauses. ISO 9001 provides the baseline framework, such as leadership, risk-based thinking, and continuous improvement. The IATF 16949 injects stringent automotive requirements into those identical clause structures. I am discussing the key structural clause references below:

  • Clause 4 (Context of the Organization): ISO 9001 requires identifying internal and external issues. IATF 16949 expands on this in Clause 4.3.2 by requiring customer-specific requirements, mandating that OEM customer specifications which are formally evaluated and included in the QMS scope.
  • Clause 7 (Support): ISO 9001 focuses on general competence and resources. IATF 16949 adds Clause 7.2.3 mandates internal auditor competency and clause 7.2.4 requires second-party auditor competency, enforcing qualification requirements for anyone conducting audits.
  • Clause 8 (Operation): ISO 9001 outlines general operational planning. IATF 16949 builds extensive automotive requirements directly into this section, covering product safety in clause 4.4.1.2 / 8.3.1.1 and embedded software, and supply chain management.

Key Differences Auditors Must Understand

To conduct a successful audit, internal and external auditors must look beyond general ISO 9001 processes and audit against automotive-specific methodologies. The general risk management of ISO 9001 per IATF makes it mandatory FMEA per clause 8.3.5.1 and contingency plans per clause 6.1.2.3. Basic process controls in ISO 9001 are strengthened by IATF 16949 to include requirement for core tools as APQP (advanced product quality planning), PPAP (production part approval process), MSA (measurement system analysis), SPC (statistical process control). The requirement of internal audits in ISO9001 clause 9.2 is made specific by including in clause 9.2.2.2-4, system, process and product audits. And the customer satisfaction is clarified with requirement for customer specific requirements (CSRs) and OEM scorecard in IATF.

Automotive Core Tools. IATF 16949 explicitly or implicitly mandates the use of five fundamental automotive core tools:

  1. APQP (Advanced Product Quality Planning): Governs product development from concept through mass production (Clause 8.3.2.1 – Design and development planning).
  2. PPAP (Production Part Approval Process): Formally verifies that manufacturing processes can consistently produce compliant parts at production rates (Clause 8.3.4.4 – Product approval process).
  3. FMEA (Failure Mode and Effects Analysis): Risk identification tool for design (DFMEA) and process (PFMEA) (Clause 8.3.5.1 – Design and development outputs).
  4. MSA (Measurement Systems Analysis): Evaluates variation in measurement equipment (Clause 7.1.5.1.1 – Measurement system analysis).
  5. SPC (Statistical Process Control): Monitors process stability and capability (Clause 9.1.1.1 – Monitoring and measurement of manufacturing processes).

Customer-Specific Requirements (CSRs)

Unlike general ISO 9001 audits, an IATF 16949 audit evaluates compliance with Customer-Specific Requirements (CSRs) (Clause 4.3.2 & Clause 7.5.1.1). Auditors must verify that OEM-specific portals, packaging manuals, labeling rules, and scorecard metrics are integrated into the organization’s daily processes.

Common Nonconformities in Automotive Audits

During certification and surveillance audits, third-party auditors frequently issue major and minor nonconformities in specific, repeat areas. Understanding these failure points allows organizations to address gaps proactively.

  1. Problem Solving (Clause 10.2.3): Organizations often submit superficial 8D corrective action plans that fail to address system-level root causes or update related PFMEAs and Control Plans (Clause 8.5.1.1).
  2. Contingency Planning (Clause 6.1.2.3): Failing to regularly test or review contingency plans for key risk events (e.g., utility outages, cyberattacks, equipment failure, supply chain disruptions).
  3. Internal Auditor Competency (Clause 7.2.3): Internal auditors lack documented evidence of competency in core tools, risk-based thinking, or customer-specific requirements.
  4. Control Plan Alignment (Clause 8.5.1.1): Discrepancies between the PFMEA, the Control Plan, and actual shop-floor work instructions.

Preparing Your Team for a Combined Audit

Organizations seeking simultaneous certification or upgrading from ISO 9001 to IATF 16949 can streamline the audit process through a structured preparation by using a four-step path. In step 1 by conducting a gap analysis & CSR mapping (clauses 4.3.2 & 6.1) as also evaluating the existing ISO 9001 processes against IATF 16949 additions and by mapping all active OEM customer specific requirements (clause 4.3.2) into the process matrix. The second step includes core tool and process alignment (clauses 8.3 & 8.5) to include verification that every PFMEA directly informs the corresponding control plan (clause 8.5.1.1) and to conduct MSA studies (clause 7.1.5.1.1) for all key gauge types listed in control plans. The step 3 is the internal process and system audits (clause 9.2) shift away from clause-by-clause checklist audits. The requirement is to perform internal manufacturing process audits (clause 9.2.2.3) and product audits (Clause 9.2.2.4) using the Turtle Diagram methodology (inputs, outputs, resources, competence, key performance indicators, and risk). Step 4 is the management review and the assessment of final readiness (clause 9.3). Holding a formal management review meeting (clause 9.3) and addressing all IATF-specific inputs, including warranty performance (clause 9.3.2.1), OEM scorecards, and action plan reviews are requirements.

Building In-House Audit Capability

The success of an IATF 16949 QMS ultimately relies on effective implementation and therefore the competence of the people auditing it. Relying solely on external consultants for internal audits can be costly and creates dependency risks. Therefore, building a team of certified lead auditors is essential. IATF 16949 clause 7.2.3 sets strict qualification requirements for internal auditors. Auditors must demonstrate, understanding of the automotive process approach for auditing, including risk-based thinking and knowledge of applicable customer-specific requirements and of applicable ISO 9001 and IATF 16949 requirements. Auditors must have competency in Core Tools (APQP, PPAP, FMEA, MSA, SPC). Establishing qualified in-house expertise transforms internal auditing from a routine compliance exercise into a driver of process performance and cost reduction.

Path to Compliance

IATF 16949:2016 lead auditor training requires completing an accredited IATF 16949:2016 training program, providing quality managers, engineers, and internal auditors with the skills needed to lead full QMS audits, evaluate complex supply chains, and ensure seamless readiness for third-party registrar audits.

Conclusion

Understanding the dynamic between ISO 9001 and IATF 16949 is critical for any automotive supplier aiming for certification and operational excellence. By mastering automotive core tools, addressing common nonconformity areas, and investing in certified IATF 16949:2016 lead auditor capability, an organization can approach certification audits with confidence.

ISO 45003 in Military Operations: A Framework for Psychological Health and Operational Readiness at Sea

Bridging ISO Management Standards and Naval Operational Readiness

Integrating ISO 45003:2021 into military operations, particularly naval operations, specifically in the context of high tempo carrier strike group deployments like the USS Abraham Lincoln and other deployments of armed forces provides a compelling framework for evaluating psychological health, operational fatigue, and organizational resilience. For subject matter experts in management system standards like me and those planning the operations and those in command the standard gives a useful framework. I think ISO 9001 clause 7.1.4 requiring creation of an environment for the operation of the processes is worth considering. This is further amplified by ISO 45001 occupational health and safety standard in general terms. The addition of ISO 45003: 2021 centered on psychological health and safety at work provides very useful guidelines for managing psychological risks. In the present context linking ISO 45003, operational readiness, and naval safety would create a strong bridge between international ISO management system standards and naval oversight. This aligns directly with how Annex SL harmonized structure connects quality, physical safety, and psychosocial well-being into a unified management architecture. After all, as Napoleon said, “morale is to physical, as two is to one”. Not to forget “an army marches on its stomach,” implying understanding risks and planning the logistics.

Operationalizing Psychological Health During Extended Naval Deployments

Operationalizing psychological health at sea is a reality particularly when deployments are extended. Applying ISO 45003 to extended deployment of military units particularly to aircraft carriers and nuclear submarines the application of the standard would enable better and systematized risk appreciation and planning. Operations planning where deployments are away from the country/ home base and the period of deployment is extended and sometimes uncertain the context and the high tempo operational environment the risks must be considered (clause 4 context of the organization of ISO 45003 leading to clause 6.1 actions to address risk and opportunities).

Psychosocial Hazards in High-Tempo Carrier and Submarine Operations

Appreciating the operational context for each deployment must consider the unique psychological hazards of high-stress naval deployments (e.g., high-speed flight operations, extended periods at sea, geopolitical tension, unpredictable schedule shifts, availability of logistics, rest and recreation, changed work hours and isolation etc.). ISO 45003 clause 4.1 explicitly mandates assessing both external aspects (geopolitical instability, extended sea lines of communication) and internal aspects (vessel design limitations, habitability, sleep architecture). For an aircraft carrier and other surface units the bridge physical safety with psychosocial risk management are relevant inputs. Physical safety controls (ISO 45001) are incomplete without addressing operational stress, decision fatigue, sleep deprivation, and psychological safety (ISO 45003). These are further extenuated in nuclear submarines where prolonged submergence, lack of natural light, and extreme isolation amplify cognitive strain.

The Three Domains of Psychosocial Risk Under ISO 45003 Clause 6.1.2.1

Understanding the ISO 45003 framework in a naval unit and incorporating it in operational planning would provide the systematized resource planning and preparations. ISO 45003 as a guidance document that extends ISO 45001 by identifying psychosocial hazards across three key domains outlined in sub-clause 6.1.2.1. It can look at how work is organized (clause 6.1.2.1.1: shift patterns, watch standing rotations, high workload, administrative overload). Then there are the social factors (clause 6.1.2.1.2: command climate, communication, leadership dynamics, isolation) and a discussion on work environment and hazardous tasks (clause 6.1.2.1.3: confined spaces, high noise, operational danger, vibration, high heat on flight decks). All these and more that commanders at sea could provide would enable better defining of the context of the organization.

Mapping ISO 45003 Clauses to Carrier Strike Group Operations

Looking at the clauses in ISO 45003 the key clauses mapping and deployment application would strengthen the planning effort. For example, the operational planners could map key ISO 45003 clauses directly to operational conditions aboard a deployed aircraft carrier.

Clause 4 — Context of the Organization

ISO 45003, clause 4, context of the organization covering context and needs of personnel in clause 4.1 / 4.2 requires assessing external drivers (geopolitical conflict, extended deployments) and internal stressors (watch schedules, habitability, separation from families). Clause 4.3 further reinforces defining the boundary of the management system thereby ensuring psychological safety applies equally to organic ship’s company, embarked air wing personnel, and staff elements.

Clause 5 — Leadership and Worker Participation

Clause 5 related to leadership and worker participation in clause 5.1 / 5.4 provides the inputs for leadership commitment to psychological safety. Clause 5.1 requires top management to demonstrate accountability by ensuring resources are allocated for mental health support, while Clause 5.4 mandates consultation with personnel without fear of reprisal. Demonstrating that leadership balances mission accomplishment with crew fatigue and mental well-being, fostering open communication without stigma or fear of career reprisal.

Clause 6 — Planning and Psychosocial Risk Assessment

Clause 6 related to planning and psychosocial risk assessment in clause 6.1.2 requires proactive identifying of psychosocial hazards. Evaluating the compounded impact of fatigue, high job demands, low autonomy, and environmental stress on deck and in combat direction spaces. Under clause 6.2, commands must establish measurable objectives regarding fatigue metrics, rest-hour compliance, and psychological safety indicators.

Clause 8 — Operational Control and Risk Elimination

Further clause 8, operational control and risk elimination in clause 8.1.2 looks at implementing operational controls managing watch and station bill rotations, enforced rest cycles, access to mental health professionals (e.g., Chaplain, OSCAR t[i]eams), and clear command communication. In line with ISO clause 8.1.1, controls must follow a hierarchy—where hazard elimination isn’t feasible during combat operations, robust administrative controls (enforced circadian watch schedules, rotational relief) become the primary line of defense.

Clause 7 — Support, Competence, and Communication

Clause 7 (support) also plays a key role here through clause 7.2 (competence) and clause 7.4 (communication). Division Officers and Chief Petty Officers must be competent in recognizing early signs of psychological distress, while transparent communication down the chain of command during schedule changes directly mitigates rumor driven anxiety.

Auditing Psychological Safety: The PDCA Cycle and Clause 9

The PDCA (plan, do, check and act) cycle which is the fundamental of the process-based management system approach in implementing all the harmonized standards which includes ISO 45001 and in this case ISO 45003, the check stage is important. Therefore, effective auditing of psychological safety by the armed forces auditors would drive continual improvement. Clause 9.1 (monitoring, measurement, analysis and performance evaluation) combined with clause 9.2 (internal audit) provides the mechanism for this verification. The discussion would bring up how they conduct independent, third-party evaluations across the Naval Enterprise to verify risk controls and safety management systems (SMS). Auditing beyond physical compliance of ISO 45003 lens requires analysis of how service auditors can evaluate whether a command is “safe to operate and operating safely” by assessing psychosocial health metrics including by self-assessment and self-correction. They would ask questions including if the command leadership evaluate fatigue and burnout indicators prior to high-risk flight deck operations? Audit traps and behavioral indicators would include auditing beyond surface-level checklists and looking at medical department stress reports, watch stander qualification pacing, incident reports linked to human error, and command climate surveys.

Worker Involvement and Psychological Safety Within Military Command Structures

One of the underlying principles in OH&S is involvement of the workers. In all other standards the leadership decisions are sufficient. However, in occupational health the worker involvement and perception on feeling safe, secure and healthy is important. This can sometimes cause conflict with military requirements when command and control may require going in harm’s way. This does not imply, not considering the risk. Therefore, incorporation of risk evaluation and communication is a factor. Testing if junior sailors and division officers feel empowered to stop unsafe evolutions caused by acute fatigue or psychological strain (psychological safety in practice) keeping within the military directions is a factor in interpretation of the standard. This directly operationalizes clause 5.4, proving that worker participation can coexist with traditional military command structures by establishing clear boundaries where operational safety interventions are welcomed rather than penalized.

Strategic Benefits of Integrating ISO 45003 and ISO 45001

Strategic benefits and recommendations in incorporating ISO 45003 with ISO 45001 in working systematically would include strengthening operational readiness and resilience. Use of ISO 45003 would address hazards directly reduces human-factor mishaps, improving retention, and enhances tactical focus during critical operations. Clause 10 (improvement) ensures that lessons learned from near-misses, fatigue-related mishaps, or extended surge operations feed back into operational planning for future deployment cycles.

Practical Recommendations for Naval Quality and Safety Systems

Practical recommendations for naval quality and safety systems would include formalizing psychosocial audit criteria by incorporating ISO 45003 guidelines into naval safety audit protocols alongside physical safety metrics. Predictive fatigue management by using data-driven scheduling tools aligned with clause 8 operational controls would be a strong recommendation. Of course, leadership training would educate senior leadership and department heads on identifying early indicators of psychosocial distress within division teams.

Conclusion: Mental Well-Being as a Core Operational Readiness Metric

In conclusion, I would say treating mental well-being and psychosocial risk management as core operational readiness metrics validated through rigorous auditing and oversight helps ensure that capital assets like the USS Abraham Lincoln remain fully combat-capable and resilient.

[i] OSCAR Team Uses Technology to Identify Mental Health Risk Factors — Navy Medicine (link at the “Chaplain, OSCAR teams” reference) — https://www.med.navy.mil/Media/News/Article/2609002/oscar-team-uses-technology-to-identify-mental-health-risk-factors/

About the Author:

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

What the ISM Code Can Teach Us About Risk: Part Two

Editor’s note: This is the second of a two-part article examining the risk-based thinking lessons to be learned from maritime safety and security protocols. You can read part one here.

The International Safety Management (ISM) Code brings a framework for safety through systematic management. It was introduced by the International Maritime Organization after several major maritime accidents revealed a common problem: The causes were rarely technical alone; instead, they were failures of management systems. The ISM Code, therefore, established a simple but powerful requirement, wherein shipping organizations must implement a documented safety management system (SMS) to ensure the safe operation of ships and the protection of the environment.

The principles embedded in the ISM Code offer valuable lessons for organizations operating in any uncertain environment. Many of these principles also resonate strongly with ISO 9001, the international standard for quality management systems. Let us examine a few of those connections.

Connecting the ISM code and ISO 9001

The ISM Code is not a technical manual for operating ships. Instead, it requires organizations to establish structured processes addressing leadership responsibility, risk assessment, operational control, training and competence, incident reporting, corrective action, and continual improvement. These requirements may sound familiar to anyone working with ISO management system standards such as ISO 9001 and others following the harmonized structure. In essence, the ISM Code recognizes a fundamental truth in that safe operations are the result of disciplined management systems, not individual heroics.

Establishing an SMS based on the ISM code and principles of ISO 9001 means planning for the unexpected. One of the most relevant principles in the ISM Code is the requirement to identify potential emergency situations and establish procedures to respond to them. Ships are required to plan for events such as fire, collision, grounding, machinery failure, person in water, and/or security threats or piracy. (Note that maritime security is covered by the International Ship and Port Facility Security Code and ISO 28001 covering security management systems for the supply chain). These procedures are not theoretical. Crews regularly conduct drills so that when an emergency occurs, the response is not improvised.

Organizations often interpret risk narrowly, focusing only on operational or financial risks. The ISM Code reminds us that effective management systems anticipate unexpected and low-probability events that can disrupt operations. In quality management terms, this is the discipline of considering what could go wrong and if people know their roles if (when) it does. It also means interrogating the system to determine how the organization will handle the ramifications of the adverse event.

Leadership and responsibility are important in maritime life. Another core principle of the ISM Code is clear authority and responsibility. Sections 5.1 and 5.2 require that on board a ship, there is no ambiguity about who is responsible for the safety of the vessel. The master has overriding authority. At the same time, as per section 4, the ISM Code requires those off the ship to support the master through a defined role known as the Designated Person Ashore (DPA). This individual provides a direct link between shipboard operations and top management. This structure reflects two key leadership principles: Authority must match responsibility and top management must remain connected to operational realities.

ISO 9001 expresses the same idea in a different context. As seen in clause 5.1 (“Leadership and commitment”) and clause 5.3 (“Organizational roles, responsibilities, and authorities”) leadership is required to ensure that the quality management system is integrated into the organization’s processes and that responsibilities and authorities are clearly assigned. Without this alignment, procedures quickly become paperwork rather than operational guidance.

In the case of mariners, competence and training are systematized. The International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW) ensures that seafarers are properly trained and certified for their duties. But beyond certification, maritime safety culture emphasizes something equally important: continuous drills and practice. Crew members rehearse emergency responses repeatedly. Fire drills, abandon-ship drills, and damage-control exercises are conducted not because emergencies are frequent; instead, it is because although they are rare, they are also highly consequential. This principle translates directly into quality management. Competence is not merely about qualifications; it is about preparedness to perform under pressure. Organizations that rely solely on written procedures without practical rehearsal often discover gaps only when a crisis occurs.

Learning lessons from incidents, as seen in ISO 9001’s clause 7.1.6 (“Organizational knowledge”) is integral to the SMS, making it a critical requirement of the ISM Code requiring the reporting and investigation of nonconformities, accidents, and hazardous occurrences. The purpose is not to blame, but to learn. Each incident becomes an opportunity to ask, “What failed in the system?” “What corrective action is needed?” and/or “How do we prevent recurrence?” Again, this is entirely consistent with ISO 9001’s approach to corrective action and continual improvement. The difference in the maritime world is that the consequences of failure can be immediate and severe. As a result, the discipline around incident learning is deeply embedded in the culture.

Risk decisions at sea and in maritime organizations need consideration about all key decisions, including how and when to transit dangerous areas. These decisions are rarely simple. They require balancing safety risks, commercial pressures, and regulatory requirements, including ever-changing statutory requirements of various contracting governments. This must be seen within the contexts of operational capability and the need to ensure crew welfare. The ISM Code does not dictate the decision. Instead, it ensures that the process for making the decision is structured and informed. This is perhaps the most valuable lesson for quality professionals. Management systems do not eliminate risk; they provide a framework for making better decisions about risk.

The ISM Code as a case study for risk-based thinking

Mariners have much to teach quality professionals on the use of the system approach for considering risks. For those working in quality assurance, auditing, or conformity assessment, the maritime experience offers several enduring lessons:

  • Systems matter more than individuals; therefore, while competent people are essential, reliable operations depend on structured systems.
  • Leadership must remain engaged in safety or quality, and this accountability cannot be delegated away.
  • Leaders must prepare for rare but high-impact events, because risk management is not only about what happens frequently.
  • Practice builds readiness.
  • ISM auditor Training and drills ensure procedures work under real conditions.

The takeaway is that there is a need to learn relentlessly from failure and use nonconformities as opportunities to strengthen the system.

The need to navigate uncertainty strengthens the importance of the ISM Code and/or ISO 9001 to inform leaders about risk and process management. For ship owners and masters, decision-making requires a complete and quick update of risks and other factors. For those who have spent a lifetime at sea, uncertainty is part of the profession. Mariners routinely navigate storms, mechanical failures, and complex navigational environments. Yet despite these uncertainties, global shipping remains remarkably reliable. More than 80 percent of world trade moves by sea, and the system functions with a level of safety and predictability that most industries take for granted.

The ISM Code, as well as ISO 9001, recognize that outcomes, whether safety or quality, depend on well-defined processes and leadership oversight. To mariners and quality professionals alike, I would advise another close look at your management system. Strengthen it. Maritime leaders ashore, like executives in the boardroom, must stay involved in assessing and mitigating risks to provide the best chance for safety, security, and success.

__

About the author

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

Home » Headquarters

What the ISM Code Can Teach Us About Risk: Part One

For centuries, individuals have sailed the sea, perhaps for their livelihood, perhaps for adventure, or perhaps for reasons of their own. Christopher Columbus, Ferdinand Magellan, James Cook, and countless others changed the world.

Today, sailing through international waters to meet the basic needs of the world brings challenges. Without merchant ships, tankers, bulk carriers, and container vessels, the global supply chain stops. Doesn’t the world owe these mariners all due safety and security?

I am a former seafarer who commanded submarines in the Indian Navy and then continued my career as a master in the merchant marine. Today, I am a subject matter expert in issues related to maritime safety and security. Given this background, I feel compelled to analyze what I hear and read about current events and provide a structure whereby the merchant marine industry might better prepare for any and all eventualities. The International Safety Management (ISM) Code, the International Convention on Standards of Training, Certification and Watchkeeping for Seafarers (STCW), and ISO 9001 all provide process-based approaches that can be used by those in this industry for planning and risk mitigation.

Most of us do not have to deal with high-risk challenges at sea. For those who do, however, there are guidelines they can use. As one example, the ISM Code provides some lessons into anticipating the unexpected and planning for these risks in a systematic manner.

In this article I will touch on how portions of the ISM Code connects to elements of ISO 9001 and provide input that might be useful to maritime leadership in ensuring quality assurance and conformity assessment based on risk and considering the context in which these organizations operate. This is guidance that applies to any of us, on the water or in a facility or factory.

Similarities between the ISM Code and ISO 9001

For professional mariners, a simple rule applies: Conditions that appear routine can change without warning. The ISM Code emphasizes preparedness for emergencies and abnormal situations. Section 8.1 requires the organization to establish procedures to identify, describe, and respond to potential emergency situations aboard the ship. In other words, the ISM Code requires organizations to plan not only for technical failures or weather hazards, but also for security risks and unexpected external threats. Navies may refer to this as an operational assessment, but (in Shakespearean language) a risk by any other name would still be a risk.

ISO 9001 expresses a comparable idea through the requirement for risk-based thinking. As emphasized in clause 6.1.1, the organization shall determine the risks and opportunities that need to be addressed to give assurance that the quality management system can achieve its intended results.

From a management systems perspective, the broader lesson is clear: Organizations must plan for situations that may appear unlikely until they occur. For a ship’s captain or master, that planning may involve security drills, contingency routing, and coordination with naval authorities. For a quality manager or organizational leader, it may involve supply chain disruption, cybersecurity incidents, or geopolitical shocks. Ultimately, the decision on whether to sail should be based on a proper risk assessment. Events at sea sometimes remind us, in stark terms, why disciplined safety and command systems matter. What makes an incident significant in the context of this discussion is the reminder of just how quickly circumstances can change at sea.

Within ISO 9001, the context of the organization (clauses 4.1 and 4.2) leads to risk appreciation (clause 6.1). All of this must be integral parts of the maritime management system, at sea or ashore.

This is precisely why the ISM Code emphasizes preparedness for emergencies and abnormal situations as per section 8.1. Good organizations connect real maritime events with risk-based thinking. They understand that commercial interests must mesh with the emergency planning sections in the ISM Code. This understanding is also found in ISO 9001, specifically in clause 6 (“Planning”) and clause 8 (“Operation”).

Expecting the unexpected

My own appreciation for disciplined systems thinking was shaped long before the ISM Code was widely implemented in commercial shipping. During my years in the Indian Navy, I had the privilege of commanding vessels, first on F-class boats and later through service on a Charlie II-class submarine. Submarines operate in an environment where uncertainty is not theoretical and the margin for error is extremely small. Any failure in equipment, communication, or procedure can quickly become critical. What keeps submarines safe is not individual brilliance on the part of a captain or crew. That is part of it, of course, but even more important is the relentless adherence to procedures and constant preparation for contingencies. Before every patrol, the crew repeatedly rehearses emergency actions such as flooding drills, fire drills, loss of propulsion, and loss of power. Each crew member knows precisely where to go, what valve to operate, and what sequence of actions to follow. These procedures are not simply found in written manuals. They are practiced until they become instinctive.

At that time, we did not describe this discipline in terms of “process-based management systems,” but that is exactly what it was. The system existed to ensure that when the unexpected occurred, as it inevitably does at sea, the crew would not rely on improvisation alone. The response would already be embedded in the system and in themselves. Years later, when I sailed as a master in the merchant marine and then began to work with ISO management systems, I recognized the same principles expressed in a different language. ISO 9001 requires organizations to establish, implement, and maintain the processes needed for the quality management system and their interactions, as per clause 4.4 (“Quality Management System and its Processes”). Section 1.2 of the ISM Code similarly requires organizations to ensure safe practices in ship operation and a safe working environment. Different industries, different terminology, but the underlying idea is identical: Safety, quality, and reliability are the result of preparation and training, not simply reacting well to emergencies.

I can confirm through my experience that this reflection is not merely theoretical. It comes from first-hand experience wherein I led teams and where preparation truly mattered. This background gives me a clear perspective on risk, command responsibility, and disciplined procedures under uncertainty. This perspective can make a very compelling bridge between maritime safety management (ISM/STCW) and organizational quality systems (ISO 9001).

As we consider dangerous situations on or in the water, we can see what the ISM Code and ISO 9001 (in addition to other maritime protocols and ISO standards) can teach us about risk in uncertain times. In today’s volatile world, commercial shipping once again finds itself navigating geopolitical tension. News headlines remind us that vessels may need to transit waters where the risks are not merely commercial, but also matters of safety and survival. For those who have spent a career at sea, such circumstances are not entirely unfamiliar. The maritime profession has long recognized that uncertainty is inherent to operations. Ships sail through storms, equipment failures, and occasionally conflict zones. Yet despite these uncertainties, shipping remains one of the safest and most reliable global industries. This is not an accident. Much of that safety culture comes from the ISM Code, supported by training standards such as STCW. These frameworks provide reliable, structured guidance on how organizations anticipate risk, prepare crews, and maintain operational control.

In the next part of this two-part article, we will further discuss the framework of maritime systems and how they relate to risk and ISO 9001.

__

About the author

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

The Double-Work Myth: Why Integrating ISO 9001 and ISO 14001 Cuts Effort, Cost and Stress

An integrated management system (IMS) combining ISO 9001 (quality) and ISO 14001 (environment) is not double the work – it’s half the effort. Built on the shared Annex SL High Level Structure, an IMS eliminates siloed audits, redundant documentation, and conflicting objectives, replacing them with a single, unified framework for operational excellence.

A classic Efficiency and Silos Battle

The harmonized standards were not available till about 2012. Yet at QMII, we talked about an integrated approach to management and worked with organizations on the advantages of the integrated management system (IMS) or combined management systems. Why this discussion? It is a classic efficiency and silos battle. Many organizations treat ISO 9001 (quality management system, QMS) and ISO 14001 (environmental management system, EMS) as two separate burdens, often managed by two different departments that barely speak. With the emphasis on ISO 45001 (occupational health and safety, OHS) in recent times, we can see that an environmental impact could cause health consequences. Yet I see large organizations with siloed departments. In this short article I want to challenge and leave this for discussion that this double the work myth is incorrect and how the Annex SL harmonized structure makes various standards natural partners.

Demystifying the Parallel-Path Myth

This myth of the parallel path must be demystified at the highest level. In many boardrooms, ISO is a word associated with binders, audits, and administrative fatigue. When a company decides to pursue both quality (ISO 9001) and environmental (ISO 14001) and other standards, the gut reaction is often to build two or as many separate systems as for each applicable standard. My first question is why manage your business as if your quality goals, OHS goals, asset management goals, crypto security goals, business continuity goals and your environmental impact etc. happen in different buildings? An integrated management system (IMS) isn’t just possible, it is the only way to achieve true operational harmony and genuine continual improvement.

The foundation of the integrated management system: Annex SL (High Level Structure). The secret weapon for harmonization is Annex SL. Most of the harmonized standards share identical core structures, meaning the skeleton of the management system is already the same. They share terms, definitions, and most importantly, their core clauses.

Harmonizing Context and Leadership (Clauses 4 and 5)

If I put this in phases, then the phase 1 would be to look at harmonizing the context and leadership. Let us simplify this discussion take just two standards, ISO 9001 and ISO 14001. At the start of both standards, the requirements are nearly indistinguishable in intent:

  • Clause 4: context of the organization would then not require doing two SWOT analyses, just do one. Identify your internal and external issues once. Under clause 4.2, the organization can identify the interested parties. A customer (quality) and a local regulatory body (environment) are both stakeholders. Managing them in one register ensures that environmental compliance doesn’t accidentally bottleneck quality delivery.
  • Clause 5: leadership and commitment where most un-integrated systems fail. Management shouldn’t have to attend two different management review meetings. Integration forces leadership to view quality and sustainability as two sides of the same strategic coin. One policy, one set of roles, and one unified vision based on risks across the organization.

Phase 2: Integrated Planning and Risk (Clause 6)

The phase 2: then I would say would be the integrated planning and risk. This is where the heavy lifting of harmonization happens.

  • Clause 6.1: Actions to address risks and opportunities — a cornerstone of risk-based thinking in both standards. In ISO 9001, the organization looks at risks to product quality. In ISO 14001, you look at environmental aspects and impacts. By combining these in a single integrated management system, you see the full picture. For example, a chemical change in manufacturing might improve product durability (9001) but increase hazardous waste (14001). If these systems aren’t harmonized, you solve one problem only to create another.
  • Clause 6.2: objectives and planning harmonization enables the organization to set smart objectives that satisfy both standards simultaneously, such as reducing material waste which then lowers costs (quality) and reduces environmental footprint (environment).

Phase 3: Unified Support and Operation (Clauses 7 and 8)

Phase 3: could be unified support and operation and would meet the requirements of clauses 7 & 8 of both standards:

  • Clause 7: support would not need two sets of document control procedures or two different training programs. Clause 7.2 (competence) and clause 7.3 (awareness) can be handled through a single employee onboarding process.
  • Clause 8: operation while ISO 9001 focuses on operational control of the product and ISO 14001 focuses on life-cycle perspective and emergency response, they both live on the shop floor. Integrating these means the organization’s standard operating procedures (SOPs) include environmental safeguards alongside quality checks.

Phase 4: Single Approach to Evaluation and Improvement (Clauses 9 and 10)

Phase 4: would then be a great advantage to the organization as it would provide the single pane of glass evaluation with the greatest efficiency gain in an IMS coming during the evaluation phase.

  • Clause 9.2: internal audit would be simpler and give more productivity. After all, why pay for or conduct two separate audits? A harmonized internal audit looks at a process from start to finish, checking for quality defects and environmental non-conformance in one walk-through.
  • Clause 9.3: management review would bring quality data and environmental performance to the same table and would allow executives to make resource allocation decisions based on the whole business, not just a siloed report.
  • Clause 10: Improvement. Corrective actions (clause 10.2) should follow the same root-cause analysis (RCA) path within the PDCA (Plan-Do-Check-Act) cycle. Whether a part failed a stress test or a spill occurred, the process for fixing the system and preventing recurrence is identical. The risks are common.

From Fragmentation to Harmony

The concluding phase would bring the organization to move from fragmentation in the approach to bringing harmony by combining ISO 9001 and ISO 14001. It isn’t just about saving paper or reducing audit days. It’s about organizational maturity. When organizations harmonize these systems, they stop treating quality and environment as extra tasks and start treating them as the standard way of doing business. For those who still don’t appreciate the value they need to look at the bottom line. Less redundancy, clearer communication, and a unified strategy are the hallmarks of a company that isn’t just compliant, but competitive.

Both ISO 9001 and ISO 14001 are now updated and revised in 2026. The update of other standards including the aerospace and other industry standards will follow.  The change to clauses in the updates of the standards is minimal. It means the structure will be same; the emphasis is in the implementation. As organizations move toward ESG (Environmental, Social, and Governance) reporting, having a harmonized ISO 9001/14001 integrated management system (IMS) provides the verified QMS and EMS data needed to back up those high-level sustainability claims.

Then there is the cost saving angle too. Human ROI of systems engineering must be considered. In the world of ISO, we often talk about process efficiency, but we forget that stressed employees are the primary drivers of hidden costs. When a system is fragmented, people are forced to become the glue manually reconciling data, filling out redundant forms, and bracing for audits. That glue is expensive, and eventually, it cracks. There is a need to bridge that connection. Stress drains the bottom line, often termed the friction tax. In a siloed organization, employees pay this friction tax daily perhaps as a decision fatigue when quality and environmental objectives conflict, managers hesitate. Hesitation delays production. Then another one of the common costs is the audit anxiety. If an internal audit feels like a blame game session because the paperwork is a mess, morale drops. Low morale leads to higher turnover and the cost of replacing skilled employees are often twice their annual salary. The need to make double entries wherein technicians must log a chemical spill in the quality log and also in the environmental log. It is not just annoying but a sheer waste of billable hours.

The Business Case: A Clear ROI

The logic of the harmonized integrated management system therefore provides a clear ROI. Organizations can visualize the connection for example in reduced waste (clause 8.1) where an integrated process ensures that doing it right the first time (quality) also means using only what is necessary (environmental). Less scrap material means lower disposal costs and lower procurement costs.

Leaderships understand the importance of a proactive system. Being predictive is better than a system which is reactive. If the organization is all the time firefighting the stress will be more. A harmonized system uses clause 6.1 (risk management) to prevent fires before they start. It is significantly cheaper to maintain a machine (preventing both a quality defect and an oil leak) than it is to clean up a disaster. Streamlined training is another plus of the harmonized system. By integrating requirements, you reduce the time employees spend in training rooms and increase the time they spend on the value-add line.

The ultimate goal of any management system isn’t to pass an audit. It is to provide a stable platform for the business to grow. When we treat ISO 9001 and ISO 14001 (as also other relevant standards) as separate entities, we inadvertently bake friction into our corporate DNA. We create a system where the left hand ignores the right, and the employees the organization’s most valuable assets, pay the price in stress and burnout. By harmonizing these systems into a true integrated management system (IMS), organizations eliminate the friction tax. Administrative noise is replaced with operational clarity. When a system is integrated, clause 10 (Improvement) ceases to be a chore and becomes a natural byproduct of a focused workforce. In summing up I would say less complexity leads to less stress. Less stress leads to fewer errors. Fewer errors lead to less waste and higher ROI. For those who still view integration as a nice-to-have, remember in an increasingly volatile market, the most successful companies aren’t the ones with the most binders on the shelf they are the ones with the most streamlined, intuitive, and stress-free processes. Integrating ISO 9001 and 14001 isn’t just a technical exercise, it is a commitment to organizational health. When your management systems work in harmony, your people can finally stop managing the system and start managing the business.

—

About the Author:

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

The Hidden Signals of Process Breakdown

When implementing management system, the organizations are really not trying to reinvent the wheel.  The availability of ISO standards gives us a well tried, over the years updated approach in terms of the available clauses. The PDCA (plan, do, check and act) cycle approach in the harmonized standards enables designing an effective management system, monitoring it and updating it to not just produce confirming products and services but also to use inputs at the check stage to continually improve it. Yet the systems fail. Non-conforming products are released. Is there then an anatomy of a quiet failure? Indicators that will enable discovering these signals proactively. If that can be analyzed organizations would appreciate these hidden signals of the system breakdown and take proactive measures. Risks and trends are data driven. Can we expect our auditors to proactively recognize these.

There is the lagging indicator trap between being reactive and proactive. Up to the 2015 version of ISO 9001 (and equivalent industry specific standards in the harmonized structure) preventive action was taken based on data, invariably at the act stage of the PDCA cycle. From the 2015 version onward clause 6.1 introduced the risk appreciation requirement at the plan stage itself and then throughout the work cycle. Separating knowledge (clause 7.1.6 of ISO 9001) from competence (clause 7.2 of ISO 9001), has introduced us to corporate knowledge in terms of lessons learnt. Leadership in analyzing changing context and risk thereof should be on the lookout for indicators.  Therefore, the PA (preventive action) concept needed a change to risk. The idea was not to throw the baby with the bathwater. NC (non-conformity) did drive correction and CA (corrective action), however, as the organization collected data it became proactive wherein data drives risk and trends. Waiting for a nonconformity (NC) is a reactive strategy. Therefore, organizations should not be we waiting for NCs. By the time an NC appears, the financial or quality damage is already done. Being proactive therefore, is the need of a functioning system.

With the ISO 9001 revised 2026 version expected in September 2026 there is, quite correctly the need to strengthen the check stage. The organizations will expect better auditing instead of just a check list being completed. The auditor’s sixth sense to ask better questions and to establish how the system is working will be important. Just having a frame and expecting it to do magic and pinpoint failures of the system is not sufficient, but the need is for a high-level pattern recognition. The skilled auditors look for the erosion of intent, where the way work is done drifts away from how it was designed. They need is to provide these inputs during audits to the leadership.

For the organizations and the auditors there are many signals of this hidden failure. There is the tribal knowledge drift as recognizing the symptoms, where the question is: “how do you do XXX?” and the employee reaches for a handwritten sticky note or a personal notebook instead of the official SOP (standard operating procedure). The hidden meaning here is that the official process is likely too rigid, outdated, or inaccessible. This is indicative of a workaround culture in its infancy. Then there is the risk scalability. The process lives in heads, not in the systems. This is indicated by when those people leave, the process collapses. Technically it was not a system. The system instead of being a working process was dependent on individual competence.

Good auditors are conscious of another signal indicated by the language used and the linguistic friction. The Symptom here is in phrases like “we usually just…”, or “on a good day, we…”, or “that’s just how we have to do it.” In these and similar cases the hidden meaning is indicating to the organization and to the auditors that the standard process is no longer the path of least resistance. For a good auditor the clue is the hesitation or glance-exchanges between team members when answering simple procedural questions. Looking ahead at expectations of the ISO 9001, 2026 version of the standard the auditors need to be conscious of how the system is actually working, working or not working.

The next signal to watch out for could be the ghost workload (shadow processes) indicated by the excessive use of excel trackers to manage data that should be in the ERP/QMS, or the need for frequent offline meetings to fix recurring errors or the use of tiger teams to cover the back log. The hidden meaning of this should be clear. The formal system is failing to provide the necessary utility. Also, that the risk is not being proactively data driven. Data integrity and lack of visibility by the management leads to the leadership  seeing a green dashboard, when the reality is red and it is showing a mirage of being held together by manual labor.

Related to this is the physical and digital clutter. The clear symptom of this e.g.  in a physical plant, it’s unlabeled bins or “red tag” areas that haven’t moved in months. In a digital space, it’s numerous versions of the same document with names like final_vrn2_use_this.pdf. etc. The implication of this is the loss of 5S discipline (sort, set in order, shine, standardize, sustain). Clutter is a visual representation of a mind and of a process that has lost its focus.

Good auditors must also consider the human element and its connected emotional cues like the defensiveness vs. transparency conflict. If a process owner is overly protective of their territory, they are often hiding a breakdown they don’t know how to fix. It can also be a conflict between fatigue and apathy leading to when and why? This is answered with rationalization, because that’s the rule, the connection between the task and the value (quality) has been severed.

My concluding thought is to prepare for implementation of ISO 9001:2026 (expected in September 2026). In preparing understand that the auditors should be becoming proactive auditors. They need to shift the goal and change their attitude. The goal isn’t to catch people; it’s to catch the process before it fails them and therefore the organization. The value add is that a skilled auditor saves the company money by identifying these frictions before they turn into a notice of inspection by a statutory body, a client, a recall, or a lost certification. Organizations should expect their auditors to catch these hidden signals of process breakdown timely and report them. A good audit report should include these and this should be the expectation.

—

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

Auditing Risk Management: How Experienced Auditors Identify Risks That Aren’t Listed in the Risk Register.

Organizations today rely heavily on risk registers to track and manage potential threats. Risk registers are useful tools, and they document known risks, assess their likelihood and impact, and assign ownership for mitigation actions. They help leadership visualize risk exposure and provide a structured way to prioritize responses.

However, risk registers have their limits. Experienced auditors know something critical, that the most damaging risks are often the ones that never appear in the register. A risk register represents what the organization already knows or believes it knows. The context of the organization changes. A risk register reflects the thinking of the team that created it. But risks evolve, environments change, and assumptions become outdated. As a result, relying solely on the documented register can create a false sense of security. Seasoned auditors understand that their responsibility goes beyond verifying that risks are listed and mitigations are documented. Their deeper role is to identify blind spots and record risks that exist outside the documented system. This is where experience, professional skepticism, and systems thinking become essential. Skilled auditors recognize patterns, inconsistencies, and subtle signals that indicate hidden risks. QMII specializes in risk and with our forty plus years in the system field, in this article, we explore how experienced auditors uncover risks that never make it into the risk register and why this capability is essential for effective risk management.

The questions therefore are, why risk registers miss critical risks. I think, before examining how auditors uncover hidden risks, it is important to understand why risk registers are incomplete.

Risk registers reflect perception and often not the reality. Risk registers are typically compiled during structured workshops or periodic reviews. Participants identify risks based on their knowledge and experience. But human perception is limited. People tend to list:

  • Risks they have seen before.
  • Risks that are already familiar.
  • Risks that are easy to articulate.

But unfamiliar or emerging threats often remain invisible. For example, a manufacturing team might focus heavily on supply chain delays while overlooking risks related to cybersecurity vulnerabilities within their operational technology systems. Experienced auditors recognize this limitation and therefore treat the risk register as a starting point, not the final word.

Then there is the organizational bias which influences risk Identification. Risk registers can be influenced by internal politics or cultural pressures. Some risks may be downplayed because:

  • They reflect poorly on leadership decisions.
  • They expose systemic weaknesses.
  • They challenge existing strategies.

In such cases, risks may be intentionally or unintentionally omitted. Auditors who understand organizational dynamics pay attention not only to what is documented, but also what is missing.

Please also consider that risks often evolve faster than documentation. The modern risk landscape changes rapidly due to:

  • Technological advancements.
  • Regulatory changes.
  • Market disruptions.
  • Geopolitical instability.

Risk registers are often updated annually or quarterly. But emerging risks can develop far faster than review cycles. Experienced auditors therefore examine current conditions, not just documented assessments. The experienced auditors detect unlisted risks. The difference between routine auditing and expert auditing lies in how auditors think. Experienced auditors do not simply verify compliance. They analyze systems, behaviors, and signals that reveal underlying vulnerabilities. The ISO 9001 version expected in September 2026 expects organizations to go beyond check lists and see how their system works to produce confirming products and services.  The auditors of the future must work to providing these inputs. Several approaches distinguish their work.

The primary is developing the attitude and aptitude where the auditors look for process weaknesses, not just risk entries. Experienced auditors start by examining processes rather than documentation. Instead of asking: “Is this risk listed in the register?” They ask: “Where could this process fail?” Every process contains inherent vulnerabilities. Skilled auditors identify points where failure could occur, including:

  • unclear responsibilities.
  • lack of monitoring.
  • excessive reliance on manual steps.
  • insufficient controls.

For example, if a company relies heavily on one individual to approve high-value financial transactions, an auditor immediately recognizes concentration of authority risk, even if the risk register never mentions it. In other words, auditors uncover risks by studying how work actually happens.

Observing operational reality is another positive trait in an auditor. Documentation often describes how processes are supposed to work. But experienced auditors know that actual practice frequently differs from documented procedures. They therefore observe operations directly by speaking with frontline staff, watching processes in action and asking open-ended questions. These conversations often reveal informal workarounds, shortcuts, or unofficial practices that introduce risk. For instance, employees might bypass a cumbersome control procedure to meet production deadlines. While the process appears compliant on paper, operational reality tells a different story. This gap between documented procedure and actual practice often exposes hidden risks.

Auditors can add value by providing inputs in audit reports which connect risks across functions. Risk registers are frequently organized by departments. Each function identifies its own risks independently. But real risks often emerge between functions, where responsibilities intersect. Experienced auditors look for these interdependencies. Examples include IT changes affecting operational reliability, procurement decisions impacting regulatory compliance or sales commitments creating financial exposure and so on. When risks are examined in isolation, these connections may never be recognized. Auditors with systems thinking identify risks that arise from interactions between processes.

Another useful tip I could share with auditors would be to learn the art of questioning assumptions. A hallmark of experienced auditors is professional skepticism. They challenge assumptions that others take for granted. Common assumptions include:

  • “This control has always worked.”
  • “That vendor is reliable.”
  • “This system cannot fail.”

History repeatedly shows that risks often emerge when organizations become overly confident in their controls. Complacency is in itself a risk. Auditors therefore test assumptions by asking questions as, what happens if this control fails? Or what alternative scenarios could occur? Or perhaps, what early warning signs might exist? This mindset helps auditors uncover risks that have never been formally considered.

Identifying early warning signals should be the organizations’ role. However, it is often missed as the organization gets acclimatized to it. Hidden risks rarely appear suddenly. They often produce early signals which even if missed by the organization can be observed by the experienced auditor. These signals may include:

  • recurring minor incidents.
  • increasing process delays.
  • rising customer complaints.
  • frequent control overrides.

Individually, such signals may appear insignificant. But collectively, they may indicate deeper systemic risks. Experienced auditors are trained to recognize these patterns. They understand that small anomalies often precede major failures.

Therefore, the role of auditor experience is vital. Technical knowledge alone does not enable auditors to detect hidden risks. Experience plays a critical role. Experienced auditors develop several capabilities over time for example their ability to see a pattern recognition. Years of exposure to different organizations allow auditors to recognize patterns that others miss. They may recall similar conditions that led to failures in other organizations and apply those lessons proactively.

Systems thinking is another quality experienced auditors possess. They may be auditing a few selected processes in a particular audit; however, the system perspective must be kept in mind. Experienced auditors understand organizations as interconnected systems. They see how decisions in one area influence outcomes in another. This perspective helps them identify risks that arise from system complexity rather than isolated failures.

Experienced auditors have judgment and intuition. They know that while auditing they must remain evidence based.  Seasoned auditors also develop professional intuition. We are not recommending experience as the basis for audit decisions. Requirements should remain the primary basis. Yet this intuition arises from accumulated experience and allows auditors to recognize subtle indicators that something may be wrong, even when documentation appears complete. They therefore ask questions to unearth hidden risks.

Strengthening risk management through auditing is a desirable trait. When auditors identify risks outside the risk register, they provide tremendous value to leadership. Their insights help organizations:

  • identify emerging threats earlier.
  • improve risk identification processes.
  • strengthen internal controls.
  • enhance organizational resilience.

Most importantly, they shift risk management from a static checklist to a dynamic learning process. Organizations that encourage auditors to explore beyond the register benefit from more realistic and proactive risk oversight. Auditors must start moving beyond the checklist mindset. In some organizations, audits become overly focused on verification. Inexperienced auditors tend to look at questions in terms of, is the risk listed or is the mitigation documented or is the review completed? While these checks are necessary, they represent only the baseline of effective auditing. Experienced auditors move beyond checklist thinking by asking deeper questions:

  • What risks might exist that we have not yet identified?
  • Where could the system fail under stress?
  • What assumptions might be wrong?

This shift transforms auditing from a compliance exercise into a strategic capability.

In conclusion I would opine an experienced auditor is like a risk detective. Risk registers remain valuable tools. They provide structure, accountability, and visibility into known risks. But they cannot capture every emerging or hidden threat. That is why experienced auditors play such a crucial role in risk management. By observing operations, questioning assumptions, connecting systems, and recognizing subtle warning signs, skilled auditors identify risks that others overlook. In many cases, their ability to detect these hidden risks prevents costly failures long before they occur.

Ultimately, the most effective auditors behave not just as compliance reviewers, but as risk detectives who are constantly searching for what the organization has not yet seen.

—

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

Why Most ISO Audits Miss System Failure Signals – And How Experienced Auditors Detect Them

I have always valued the process-based management system (PBMS) approach based on the ISO standards as the best start to designing and implementing a management system that produces confirming products and services. Over time with continual improvement the system should give the ROI (return on investment). The management system is not a magic trick, agreed, it all depends on the implementation. The system starts in a responsive manner where NCs (non-conformities) drive correction and CA (corrective action). The system then matures and becomes proactive when data drives risk and trends. The internal audits should give the leadership the inputs to better resource and continually improve the system.  Yet I see organizations end up with a “checklist-style” audit where these frustrating audits do not provide the inputs to improve the system. It is often because audits treat a living system like a static inventory. Most audits miss signals because they focus on conformity (did you do what you said?) rather than capability (does the process achieve the intended result?). The intend should be to bridge the gap between “compliance” and “performance.”

The illusion of compliance pays the price. Most ISO audits fail to detect systemic rot because they are designed to find missing records, not broken logic. That is because auditors fall into the checklist trap. Standard auditors often follow a linear path. If the “management review” happened and the minutes exist, they check the box. Then there is the “paper thin” system where organizations have become experts at “audit-ready” documentation that masks operational chaos. Finally, the auditors focus on output and not on outcome during the audits, they often verify that a process ran but fail to ask if the process is healthy.

The question then is why the “signals” are missed? System failures rarely happen overnight; they emit “smoke” long before the fire. Standard audits miss these because:

  • Siloed Auditing: Auditors look at Department A and Department B separately, missing the friction and “white space” between them where most failures occur.
  • Sampling Bias: Auditors often let the guide choose the records. Experienced auditors know that the most telling data is usually in the “messy” folders the guide is trying to steer them away from.
  • Metric Manipulation: If a KPI is 99% green but the customer is complaining, the system is failing. A standard audit sees the 99% and moves on.

Therefore, the need is to see how experienced auditors “hear” the system. Veteran auditors move beyond the “what” and the “where” to the “how” and the “why.” They use a PBMS lens to detect:

  • The “work-around” signal, when employees have a “shadow” spreadsheet or a personal notebook to get the job done, the formal system has already failed.
  • The “quality debt” signal where recurring “minor” non-conformities are often symptoms of a single “major” systemic bypass.
  • Language patterns when experienced auditors listen for phrases like “we usually do it this way, but for the audit…” or “that person is the only one who knows how that works.”

The need is for auditors to transition from “auditing for points” to “auditing for risk”. To truly add value, the audit must evolve into a diagnostic tool.

  • Vertical vs. horizontal auditing where instead of checking a department, follow a single order from “quote to cash” to see where the process bleeds.
  • The “stress test” approach where auditors ask, “what happens if this person is out?” or “what happens if this supplier fails?” to test system resilience.

The key takeaways so far could be summarized as:

  • The process is the patient. Treat the audit like a medical check-up. Don’t just check the pulse; look at the lifestyle and the underlying vitals.
  • Stop re-inventing, start refining.  Since you believe in standards, emphasize as an auditor, that the ISO standards already require a process approach. Most people just ignore it in favor of the easier “clause-by-clause” approach.

As an example, we can consider a perfect paper audit that is followed by a major product recall, as indicative of illustrating the compliance-performance gap. The occurrence of a mishap, or a rejected product soon after a perfect audit should make an organization investigate its auditing effectiveness. It is necessary to take the great deep-dive and shift the focus from “did they follow the process?” to “is the process actually functioning?” is what separates a tick-box auditor from a system specialist.

In a standard audit, if the records are signed and the dates match, the process is marked “effective.” But experienced auditors know that a perfectly documented process can still be a failing one. To detect the signals most miss, you must look at the friction points the places where the “official” system meets human reality. Avoid the Illusion of compliance. In the world of ISO standards, there is a dangerous comfort in a “clean” audit report. As a specialist in process-based management systems (PBMS), I have always believed in the power of standards. Why re-invent the wheel when a global framework for excellence already exists? Yet we see it constantly: organizations pass their surveillance audits with flying colors, only to suffer a catastrophic service failure, a massive product recall, or a sudden dip in profitability weeks later.

In conclusion I would caution organizations, audit clients and auditors to stop auditing the paper, and to start auditing the pulse. If we continue to treat ISO audits as a “pass/fail” hurdle for a certificate, we do a disservice to the discipline of management. A standard is not a ceiling; it is a floor. It is the “wheel” that shouldn’t be re-invented, but it must be maintained, balanced, and aligned.

Any organization’s call to action may be called the “value-add” challenge where the organization changes the lens for the next audit cycle to:

  • Ditch the clause-by-clause audit to follow a single order from “quote to cash” rather than checking department folders.
  • Search for the “shadows” and look for the post it notes and cheat sheets. They show you where the formal system is failing to support the staff.
  • Ask “why” Five times to root cause the system. Refuse to accept “human error” as a root cause. Dig until you find the process flaw. Blaming is easy but not the answer.

The goal of a Process-Based Management System is to create a resilient, predictable, and scalable organization. Let’s stop auditing for compliance and start auditing for capability. At QMII we train our auditors for this.

—

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.

Audit Focus Areas Under ISO 28000 for 2026 and beyond

In this article on ISO 28000 I want to emphasize the audit focus areas based on what 2025 revealed and what auditors must prioritize in 2026 and beyond. The emphasis is from mere compliance to resilience leading to secure supply chains.

The year 2025 can be seen as a watershed moment for supply chain security management systems. Global supply chains were subjected not to one dominant crisis, but to a convergence of pressures, geopolitical instability, regulatory fragmentation, cyber intrusion, logistics disruption, and heightened stakeholder scrutiny. For organizations certified to ISO 28000, and for auditors charged with assessing conformity, this period exposed an uncomfortable truth, many supply chain security management systems were compliant in form, but brittle in practice.

As we look toward 2026 and beyond, ISO 28000 audits must evolve to meet these challenges. Agreed organizations must not wait for audits to ensure continual improvement, act on risks and to use the opportunities for improvement (OFI). However, this too is true that NCs (nonconformities) drive correction and CA (corrective action). As such audits play a minor part in providing inputs at the check stage of the PDCA (plan-do-check-act) cycle. Therefore, the question is no longer whether organizations have established a supply chain security management system, but whether that system is capable of sensing change, absorbing shocks, and adapting under stress. ISO 28001, as the supporting guidance standard, provides a valuable lens through which this shift can be framed, particularly in relation to risk assessment, security planning, and operational controls.

This article reflects on what audits in 2025 revealed and outlines the audit focus areas that will define credible, value-adding ISO 28000 audits from 2026 onwards. Let us first dwell on what 2025 taught the industry and look at the key audit lessons:

  1. Risk assessments were static in a dynamic threat environment. Audits conducted during 2025 repeatedly identified a reliance on periodic, document-driven risk assessments. While these assessments were often well-structured and aligned with ISO 28000 Clause 4 (Security risk assessment and planning), they frequently failed to reflect rapidly changing threat conditions.

ISO 28001 emphasizes that risk assessment should be an ongoing process, responsive to changes in threat, vulnerability, and consequence. In practice, however, many organizations treated risk reviews as annual or biennial events, disconnected from real-time intelligence, incident trends, or geopolitical developments.

The lesson for auditors was clear, conformity to the process was present, but the intent of continual risk awareness was not fully realized.

  1. Limited visibility beyond tier-1 suppliers. A second consistent audit finding in 2025 was the narrow scope of supplier security controls. Organizations could demonstrate security requirements for direct suppliers yet had little understanding or assurance of security practices deeper within the supply chain.

ISO 28001 explicitly recognizes the need to consider the full supply chain, including subcontractors and service providers, when establishing security plans and controls. Despite this guidance, audits revealed that supplier evaluation mechanisms often stopped at contractual clauses, with minimal follow-up, verification, or performance monitoring.

Security incidents originating in Tier-2 or Tier-3 suppliers highlighted the inadequacy of superficial supplier controls and reinforced the need for more robust assurance mechanisms.

  1. Cyber risks were poorly integrated into the supply chain Security. Although ISO 28000 is not a cybersecurity standard, 2025 audits increasingly revealed that cyber vulnerabilities were among the most significant enablers of supply chain disruption. Cargo tracking systems, access control platforms, vendor portals, and logistics planning tools were all identified as potential attack vectors. With harmonized structure (HS) it was presumed that an integrated management system approach could answer this but organizations did not integrate ISO 27001 and ISO 28001 by and large.

ISO 28001 encourages organizations to consider all relevant threats to the supply chain, including those affecting information and communication systems. Yet audits frequently found a disconnect between physical security management and information security governance, with limited coordination between security and IT functions.

This gap did not necessarily result in formal nonconformities, but it raised serious questions about the effectiveness of the overall security management system.

  1. Business continuity planning lacked supply chain realism. Many organizations could demonstrate alignment with business continuity frameworks and, in some cases, certification to ISO 22301 (Business Continuity). However, audits in 2025 showed that supply-chain-specific disruption scenarios were rarely tested.

ISO 28001 stresses the importance of preparedness and response planning based on realistic threat scenarios. Yet exercises involving port closures, border restrictions, supplier insolvency, or regulatory intervention were the exception rather than the rule. The result was a gap between documented preparedness and demonstrated capability, one that became increasingly visible to experienced auditors.

Based on these lessons from 2025 I think the audit focus areas for 2026 and beyond should consider:

  1. Going from risk identification to risk intelligence. From 2026 onwards, auditors will need to place greater emphasis on how organizations maintain the ongoing validity of their risk assessments. ISO 28000 Clause 4, supported by ISO 28001 guidance, implicitly requires organizations to monitor changes that could affect supply chain security risks. Audits should therefore examine:
  • The use of internal and external intelligence sources.
  • Defined triggers for risk reassessment.
  • Evidence that changes in risk lead to timely management action.

The audit question is shifting from “Do you have a risk assessment?” to “How do you know your risk assessment reflects today’s reality?”

  1. Supplier security assurance, not just evaluation. ISO 28001 provides detailed guidance on supplier security planning, including differentiation based on criticality and risk exposure. In 2026, audits will increasingly probe how supplier security requirements are implemented, monitored, and enforced. Key audit considerations will include:
  • Supplier segmentation and prioritization.
  • Proportionate security controls.
  • Evidence of supplier audits, self-assessments, or performance reviews.
  • Corrective action and escalation when requirements are not met.

Supplier security must be demonstrable and sustained, not assumed.

  1. Integration of cyber and physical security controls. Auditors should expect to see clearer alignment between ISO 28000 systems and information security frameworks such as ISO/IEC 27001. ISO 28001 supports this integration by recognizing information flow and system integrity as essential elements of supply chain security. Audit focus areas will include:
  • Identification of cyber-enabled supply chain risks.
  • Coordination between security and IT incident response.
  • Protection of logistics data, tracking systems, and access controls.

While ISO 28000 audits will not become cyber audits, unmanaged cyber dependencies will increasingly undermine audit confidence.

  1. Testing, exercises, and demonstrated preparedness. In 2026 and beyond, documented plans will carry less weight without evidence of testing. ISO 28001 places strong emphasis on preparedness, response, and recovery capabilities. Therefore, auditors should look for:
  • Scenario-based exercises relevant to the organization’s supply chain.
  • Participation by relevant internal and external stakeholders.
  • Lessons learned and system improvements following exercises.

Preparedness is best demonstrated through practice, not paperwork.

  1. Governance and leadership accountability. A notable trend emerging from late-2025 audits was increased attention to top management involvement. ISO 28000 requires leadership commitment, and ISO 28001 reinforces the importance of governance in sustaining effective security management. Audits in 2026 will increasingly examine:
  • Management review outputs related to supply chain security.
  • Resource allocation decisions.
  • Evidence of board or senior leadership awareness of key risks.

Supply chain security is no longer solely an operational concern; it is a matter of organizational governance. Therefore, implications for auditors and organizations are:

  1. For auditors, the coming years will demand deeper understanding of risk dynamics, supply chain complexity, and the convergence of physical and digital threats. Checklist-based auditing will be insufficient where resilience and adaptability are the true measures of effectiveness.
  2. For organizations, ISO 28000 should be repositioned as a strategic risk management framework. Investment in intelligence, supplier assurance, and realistic testing will not only support certification outcomes but also strengthen operational resilience.

In conclusion I would say, based on QMII experience that what 2025 has taught us is that supply chain security management systems fail not because organizations lack procedures, but because those procedures are not designed for volatility. As we move into 2026 and beyond, ISO 28000 audits must therefore measure more than conformity, they must assess resilience.

ISO 28001 provides the guidance needed to make this transition. The challenge for both auditors and organizations are to apply that guidance with realism, discipline, and strategic intent.

—

This article was written by IJ, Principal Consultant at QMII. With extensive experience in ISO standards, auditing, and organizational transformation, IJ has guided global organizations in strengthening their management systems. His approach focuses on aligning ISO implementation with strategic business objectives to drive long-term performance improvement.